Jacques Louw

Co-founder @pushsecurity

[Jacques Louw @jacques_sec]

If you're interested in defending against Cyberhaven-style attacks against browser extension vendors, I wrote a guide around hardening browser extension deployments you might find interesting: https://t.co/76RtfQfiMR

[Luke Jennings @jukelennings]

1/ A new class of phishing - how verification phishing and cross-idp impersonation can bypass your SSO.

Here is a video demo, but this is one where you really need to read the full article too - https://t.co/R6xZaawwpr

I'll summarize the key points in this thread.

[Jacques Louw @jacques_sec]

It's so cool to see the active development of evasion techniques in phishing kits - tells you a lot about the counter-evasion techniques they're running into!

[Luke Jennings @jukelennings]

Back by popular demand, I wrote a second part blog post on the many defense mechanisms phishing kits are using to avoid detection.

This second part dives deep on one specific strategy - preventing detection of commonly cloned login pages e.g. Microsoft

https://t.co/U2Pj2cClaU

[Luke Jennings @jukelennings]

I wrote a blog post on the many defense mechanisms phishing kits are using to avoid discovery and analysis now.

I used a recent instance of NakedPages and cover 9 different techniques, including Cloudflare Workers and Turnstile abuse.

IOCs included.

https://t.co/759Yd0vxm3

[Jacques Louw @jacques_sec]

@jukelennings Having seen the details I think these malware devs need to invest in a good PM and some integration testing 😅 Can't wait for the full write up!

[Adam Bateman //O @ajaybateman]

Now you can detect and block identity attacks directly inside any web browser.

1. Stop corp password reuse and phishing
2. Detect EvilGinx/EvilNoVNC
3. Session Hijacking detection
... and more.
Hear the full announcement on @riskybusiness

https://t.co/xQH9Yy2Kdj

[Jacques Louw @jacques_sec]

Awesome post from @_xpn_ https://t.co/wlj9zo6e7x - thanks for sharing MalIDP, essential modern offensive tooling!

[Jacques Louw @jacques_sec]

Really nice in-depth technical explanation of these new techniques.

[Luke Jennings @jukelennings]

I feel like shadow workflows are the closest equivalent of offensive PowerShell for the SaaS world.

Check out the second post in my series on chaining SaaS attacks and come see me speak about this and a lot more at #44con on Thursday 14th September!

https://t.co/EzsOLOQzQ2

[Jacques Louw @jacques_sec]

@KyleHanslovan @PushSecurity @DataBreachToday Thanks a mil @KyleHanslovan - but glory for this goes to @jukelennings who did the actual work (rather than blog about it!)

[Push @PushSecurity]

Great interview with our CEO and co-founder @ajaybateman and @dspark on @CISOseries about "Securing identity in the age of self-service"

"It's about creating a paved path for employees to walk..."

Link in 🧵!

[Luke Jennings @jukelennings]

1/ I kinda accidentally owned myself with my own shadow workflow attack. I definitely think they are going to become a standard technique. I mean they are pretty much the offensive powershell of the SaaS world!

So how did this happen?

[Push @PushSecurity]

👋 New feature alert!

Classify SaaS apps in the Push platform based on the sensitivity of the data they contain or the permissions they've been granted.

Use the Approval status to capture your decision about an app -- is it in or out?

Link in 🧵

#SaaSsecurity #security

[Luke Jennings @jukelennings]

I’ve just released some research into 38 SaaS-native attack techniques across the kill chain and produced a SaaS attack matrix to go along with it.

https://t.co/1bbkpI5IlC

This is just the beginning but my hope is this will become an ongoing community project.

[Push @PushSecurity]

📣 NEW FEATURE ALERT - Uncover shared SaaS accounts

Tldr - Push can now show you which app accounts are being used by multiple employees and who's using them.
#shadowit #security #infosec #rogueit #RiskManagement

Give it a try for free: https://t.co/LF5E4oejP4

[Push @PushSecurity]

Big news today - we're announcing our $15M Series A funding round, led by @GVteam. @karimfaris @jonoberheide join our board, @dugsong @richwaldron
@frfrdufour join as investors, + @DecibelVC https://t.co/3ZFhqib2Hq #VC

[Jacques Louw @jacques_sec]

@dannguyenhuu @PushSecurity @jonsakoda @ajaybateman @metall0id @jonoberheide Had a great time touring the bay area and talking product, thanks for the personal touch @jonsakoda @dannguyenhuu and @staceywueste - hope we get to meet up in person again soon!

[Push @PushSecurity]

Some amazing praise from Jason Waits, CISO at Inductive Automation on why we won their POC. His comments on our user-centric approach made our day! 🙌

[Push @PushSecurity]

Managed browser extension deployments are here! You can now be up and running with Push, with all of your employees onboarded, in minutes. https://t.co/clQrqzCx30 #SaaSsecurity #cloudsecurity

[Push @PushSecurity]

Stop blocking. Instead, equip employees to secure their SaaS. There's a better approach to securing SaaS than simply blocking and restricting unsanctioned apps https://t.co/V3qNxxOOrV #SaaSsecurity #CASB #infosec

[Push @PushSecurity]

Here's a quick guide to finding the right SaaS security solution for your company. It's basically a choose-your-own-adventure for finding a good fit for your specific use case, infrastructure, and data. https://t.co/IaIQGIPP2X
#SaaSSecurity #CloudSecurity